* Fix nightly SSH remote daemon checksum mismatch
Each nightly build overwrites the shared cmuxd-remote-* assets on the
nightly release, but older nightly DMGs have manifests with checksums
from their build time. When a user's nightly is even one build behind,
the downloaded binary doesn't match their embedded manifest.
Two-layer fix:
1. CI: version nightly remote daemon asset names with the build number
(e.g. cmuxd-remote-darwin-arm64-2362248028801) so each nightly's
manifest points to immutable files. Unsuffixed "latest" copies are
still uploaded for tooling compatibility.
2. Client: on checksum mismatch, fetch the live manifest from the
release and verify against that. This handles users on older
nightlies that predate the CI fix.
Fixes https://github.com/manaflow-ai/cmux/issues/1745
* Fix unsuffixed checksums file to use generic filenames
Regenerate cmuxd-remote-checksums.txt from the unsuffixed alias
binaries so `shasum -c` works against the generic asset names.
Also document that unsuffixed manifest intentionally keeps versioned
downloadURLs and that aliases don't carry attestation.
---------
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
The Go build runs in a subshell that cd's to daemon/remote/, but
OUTPUT_DIR was relative to the repo root. Resolve to absolute path
after mkdir so go build -o writes to the correct location.
Co-authored-by: Lawrence Chen <lawrencecchen@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
